SPO Management Shell one-liners every admin ends up needing

When to reach for them: quick answers from the official module, no app registration, no script file. Prereq:

Connect-SPOService -Url https://contoso-admin.sharepoint.com

All read-only unless marked [writes].

Top 20 site collections by storage:

Get-SPOSite -Limit All | Sort-Object StorageUsageCurrent -Descending |
  Select-Object -First 20 Url, StorageUsageCurrent, StorageQuota

Every site where external sharing is on:

Get-SPOSite -Limit All | Where-Object { $_.SharingCapability -ne 'Disabled' } |
  Select-Object Url, SharingCapability

All external users in the tenant (paged):

Get-SPOExternalUser -PageSize 50 | Select-Object DisplayName, Email, WhenCreated

Tenant-level sharing posture at a glance:

Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType

Deleted site collections still restorable (and for how long):

Get-SPODeletedSite | Select-Object Url, DaysRemaining

Restore one of them [writes]:

Restore-SPODeletedSite -Identity https://contoso.sharepoint.com/sites/projects

Freeze a site during migration or investigation [writes]:

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/projects -LockState ReadOnly
# and back: -LockState Unlock

Grant yourself (or a colleague) site collection admin [writes]:

Set-SPOUser -Site https://contoso.sharepoint.com/sites/projects `
  -LoginName megan@contoso.com -IsSiteCollectionAdmin $true

Notes:

• Get-SPOSite -Limit All returns the tenant-admin view — no site-by-site permissions needed, but also no list/content level detail (that's where PnP comes in).
• OneDrive sites are excluded by default; add -IncludePersonalSite $true when you really want them.
• Anything marked [writes] deserves a second look before Enter — especially LockState, which kicks users out immediately.